Actions

Actions define what operations a subject can perform on the target objects. The actions field is required and accepts a list of action strings.

Available Actions

Action	Description
create	Allows creating resources
read	Allows reading/viewing resources
update	Allows modifying resources
delete	Allows deleting resources
create,read,update,delete	Shorthand for all four CRUD actions
playbook:run	Allows running playbooks
playbook:approve	Allows approving playbook runs that require approval
playbook:cancel	Allows canceling playbook runs
mcp:use	Allows connecting to the MCP endpoint
mcp:run	Allows running a playbook through MCP. Intended for playbook-scoped permissions
invoke:<plugin>:<operation>	Allows invoking an operation on a plugin
plugin-role:<plugin>:<role>	Grants a role defined by a plugin

Wildcards

You can use wildcards to grant multiple permissions at once:

Wildcard	Description
playbook:*	Grants all playbook-related permissions (run, approve, cancel)
*	Grants all permissions (use with caution)

Examples

Read-Only Access

read-only-permission.yaml
apiVersion: mission-control.flanksource.com/v1
kind: Permission
metadata:
  name: viewer-access
spec:
  description: Read-only access to configs
  subject:
    team: viewers
  actions:
    - read
  object:
    configs:
      - name: "*"

Full Playbook Access

playbook-full-access.yaml
apiVersion: mission-control.flanksource.com/v1
kind: Permission
metadata:
  name: playbook-admin
spec:
  description: Full playbook management access
  subject:
    team: platform-team
  actions:
    - playbook:*
  object:
    playbooks:
      - name: "*"

Multiple Actions

multiple-actions.yaml
apiVersion: mission-control.flanksource.com/v1
kind: Permission
metadata:
  name: editor-access
spec:
  description: Read and write access to configs
  subject:
    person: editor@example.com
  actions:
    - read
    - create
    - update
  object:
    configs:
      - namespace: production

Playbook Run and Approve

run-approve-permission.yaml
apiVersion: mission-control.flanksource.com/v1
kind: Permission
metadata:
  name: playbook-operator
spec:
  description: Allow running and approving playbooks
  subject:
    team: operators
  actions:
    - playbook:run
    - playbook:approve
  object:
    playbooks:
      - labels:
          category: maintenance

Admin Access (All Permissions)

admin-permission.yaml
apiVersion: mission-control.flanksource.com/v1
kind: Permission
metadata:
  name: admin-all-access
spec:
  description: Full admin access (use sparingly)
  subject:
    team: admins
  actions:
    - "*"

warning

Using * (all permissions) should be limited to administrative roles. Always prefer granting the minimum necessary permissions.